openclacky 1.3.2 → 1.3.4

data/lib/clacky/server/http_server.rb

@@ -16,6 +16,7 @@ require "timeout"
 require "yaml"
 require "date"
 require_relative "session_registry"
+require_relative "git_panel"
 require_relative "web_ui_controller"
 require_relative "scheduler"
 require_relative "../brand_config"
@@ -217,6 +218,7 @@ module Clacky
       end
 
       def start
+        @start_time = Time.now
         # One-time migration: move legacy trash contents into file-trash/ subdirectory.
         Clacky::TrashDirectory.migrate_legacy_if_needed
 
@@ -333,6 +335,14 @@ module Clacky
         server.mount("/api", servlet_class)
         server.mount("/ws",  servlet_class)
 
+        # Health check endpoint — no auth, minimal overhead.
+        # Docker / orchestrators can probe this to decide container health.
+        server.mount_proc("/health") do |_req, res|
+          res.status          = 200
+          res["Content-Type"] = "application/json"
+          res.body            = '{"status":"ok"}'
+        end
+
         # Mount static file handler for the entire web directory.
         # Use mount_proc so we can inject no-cache headers on every response,
         # preventing stale JS/CSS from being served after a gem update.
@@ -347,12 +357,21 @@ module Clacky
         server.mount_proc("/") do |req, res|
           if req.path == "/" || req.path == "/index.html"
             product_name = Clacky::BrandConfig.load.product_name || "OpenClacky"
-            html = File.read(index_html_path).gsub("{{BRAND_NAME}}", product_name)
+            pure         = req.query["pure"] == "true"
+            html = File.read(index_html_path)
+                       .gsub("{{BRAND_NAME}}", product_name)
+                       .gsub("{{EXT_SCRIPTS}}", pure ? "" : self.send(:webui_ext_script_tags))
             res.status                = 200
             res["Content-Type"]       = "text/html; charset=utf-8"
             res["Cache-Control"]      = "no-store"
             res["Pragma"]             = "no-cache"
             res.body                  = html
+          elsif req.path.start_with?("/webui_ext/")
+            self.send(:serve_webui_ext, req, res)
+          elsif req.path.start_with?("/agent_ui/")
+            self.send(:serve_agent_ui, req, res)
+          elsif req.path.start_with?("/panel_ui/")
+            self.send(:serve_panel_ui, req, res)
           else
             file_handler.service(req, res)
             res["Cache-Control"] = "no-store"
@@ -363,6 +382,12 @@ module Clacky
         # Auto-create a default session on startup
         create_default_session
 
+        # Load user-defined HTTP API extensions from ~/.clacky/api_ext/.
+        # Done here (not at gem load) so handlers can resolve session_manager
+        # and other host helpers as soon as they are wired up.
+        # The loader logs its own summary via Clacky::Logger.
+        Clacky::ApiExtensionLoader.load_all
+
         # Start the background scheduler
         @scheduler.start
         puts "   Scheduler: #{@scheduler.schedules.size} task(s) loaded"
@@ -394,6 +419,8 @@ module Clacky
         path   = req.path
         method = req.request_method
 
+        Thread.current[:lang] = req["X-Lang"].to_s.strip.then { |l| l.empty? ? nil : l }
+
         # Access key guard (skip for WebSocket upgrades)
         return unless check_access_key(req, res)
 
@@ -412,6 +439,11 @@ module Clacky
         # generous 90s so retry + failover can complete without being cut short.
         timeout_sec = if path.start_with?("/api/brand")
           90
+        elsif path.start_with?(Clacky::Server::ApiExtensionDispatcher::MOUNT_PREFIX)
+          # api_ext dispatcher applies its own per-route timeout (capped at
+          # ApiExtension::MAX_TIMEOUT). Use the upper bound here so the outer
+          # guard never cuts a long-running custom handler short.
+          Clacky::ApiExtension::MAX_TIMEOUT + 30
         elsif path == "/api/tool/browser"
           30
         elsif path == "/api/exchange-rate"
@@ -451,6 +483,13 @@ module Clacky
         path   = req.path
         method = req.request_method
 
+        # User-defined HTTP API extensions live under ~/.clacky/api_ext/<name>/
+        # and mount at /api/ext/<name>/...  Routed through a separate dispatcher
+        # so the host's giant case table stays focused on built-in endpoints.
+        if path.start_with?(Clacky::Server::ApiExtensionDispatcher::MOUNT_PREFIX)
+          return if Clacky::Server::ApiExtensionDispatcher.handle(req, res, http_server: self)
+        end
+
         case [method, path]
         when ["GET",    "/api/sessions"]      then api_list_sessions(req, res)
         when ["POST",   "/api/sessions"]      then api_create_session(req, res)
@@ -565,8 +604,31 @@ module Clacky
           elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/skills$})
             session_id = path.sub("/api/sessions/", "").sub("/skills", "")
             api_session_skills(session_id, res)
+          elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/git/[a-z]+$})
+            session_id = path[%r{^/api/sessions/([^/]+)/git/}, 1]
+            action     = path[%r{/git/([a-z]+)$}, 1]
+            api_session_git(session_id, action, req, res)
+          elsif method == "POST" && path.match?(%r{^/api/sessions/[^/]+/git/commit$})
+            session_id = path[%r{^/api/sessions/([^/]+)/git/}, 1]
+            api_session_git_commit(session_id, req, res)
+          elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/time_machine$})
+            session_id = path.sub("/api/sessions/", "").sub("/time_machine", "")
+            api_session_time_machine(session_id, res)
+          elsif method == "POST" && path.match?(%r{^/api/sessions/[^/]+/time_machine/switch$})
+            session_id = path[%r{^/api/sessions/([^/]+)/time_machine/}, 1]
+            api_session_time_machine_switch(session_id, req, res)
+          elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/time_machine/\d+/diff$})
+            session_id = path[%r{^/api/sessions/([^/]+)/time_machine/}, 1]
+            task_id    = path[%r{/time_machine/(\d+)/diff$}, 1].to_i
+            api_session_time_machine_diff(session_id, task_id, req, res)
+          elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/time_machine/\d+/restore_preview$})
+            session_id = path[%r{^/api/sessions/([^/]+)/time_machine/}, 1]
+            task_id    = path[%r{/time_machine/(\d+)/restore_preview$}, 1].to_i
+            api_session_time_machine_restore_preview(session_id, task_id, res)
           elsif method == "GET" && path == "/api/dirs"
             api_browse_dirs(req, res)
+          elsif method == "POST" && path == "/api/dirs/mkdir"
+            api_dirs_mkdir(req, res)
           elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/files$})
             session_id = path.sub("/api/sessions/", "").sub("/files", "")
             api_session_files(session_id, req, res)
@@ -576,6 +638,9 @@ module Clacky
           elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+/messages$})
             session_id = path.sub("/api/sessions/", "").sub("/messages", "")
             api_session_messages(session_id, req, res)
+          elsif method == "GET" && path.match?(%r{^/api/sessions/[^/]+$})
+            session_id = path.sub("/api/sessions/", "")
+            api_get_session(session_id, res)
           elsif method == "PATCH" && path.match?(%r{^/api/sessions/[^/]+$})
             session_id = path.sub("/api/sessions/", "")
             api_rename_session(session_id, req, res)
@@ -627,6 +692,12 @@ module Clacky
           elsif method == "PATCH" && path.match?(%r{^/api/skills/[^/]+/toggle$})
             name = URI.decode_www_form_component(path.sub("/api/skills/", "").sub("/toggle", ""))
             api_toggle_skill(name, req, res)
+          elsif method == "GET" && path.match?(%r{^/api/skills/[^/]+/content$})
+            name = URI.decode_www_form_component(path.sub("/api/skills/", "").sub("/content", ""))
+            api_skill_content_get(name, res)
+          elsif method == "PUT" && path.match?(%r{^/api/skills/[^/]+/content$})
+            name = URI.decode_www_form_component(path.sub("/api/skills/", "").sub("/content", ""))
+            api_skill_content_update(name, req, res)
           elsif method == "DELETE" && path.match?(%r{^/api/skills/[^/]+$})
             name = URI.decode_www_form_component(path.sub("/api/skills/", ""))
             api_delete_skill(name, res)
@@ -683,6 +754,16 @@ module Clacky
         json_response(res, 200, { sessions: sessions, has_more: has_more, cron_count: @registry.cron_count })
       end
 
+      # GET /api/sessions/:id — fetch a single session by id (memory + disk merged).
+      # Used by the frontend Router when navigating to a session that isn't in
+      # the paged sidebar list (search results, URL deep links, share links,
+      # browser back/forward, external notifications, etc.).
+      def api_get_session(session_id, res)
+        row = @registry.snapshot(session_id)
+        return json_response(res, 404, { error: "Session not found" }) unless row
+        json_response(res, 200, { session: row })
+      end
+
       def api_create_session(req, res)
         body = parse_json_body(req)
         name = body["name"]
@@ -949,9 +1030,195 @@ module Clacky
         @agent_config.save
       end
 
+      # Absolute path to the user's WebUI extension directory.
+      WEBUI_EXT_ROOT = File.expand_path("~/.clacky/webui_ext")
+
+      # Build the full <script> payload injected at {{EXT_SCRIPTS}}:
+      #   1. global extensions   — ~/.clacky/webui_ext/**/*.js  (all agents)
+      #   2. agent-scoped UI     — agents/<name>/webui/**/*.js   (data-agent)
+      #   3. official panels     — default_agents/_panels/<id>/**/*.js (data-panel)
+      # Prefixed with a registerPanelAgents() call so the client knows which
+      # agent profiles reference each official panel. Never raises.
+      private def webui_ext_script_tags
+        [
+          panel_agents_script,
+          global_ext_script_tags,
+          agent_webui_script_tags,
+          official_panel_script_tags,
+        ].reject(&:empty?).join("\n")
+      end
+
+      # Inline script registering the panel→agents map (which agent profiles
+      # reference each official panel, from their profile.yml `panels:`).
+      private def panel_agents_script
+        map = panel_agents_map
+        return "" if map.empty?
+
+        "<script>Clacky.ext.registerPanelAgents(#{map.to_json})</script>"
+      end
+
+      # { "git" => ["coding", ...], ... } — scan every agent profile.yml for a
+      # `panels:` list and invert it into panel → referencing agents.
+      private def panel_agents_map
+        result = Hash.new { |h, k| h[k] = [] }
+        agent_profile_dirs.each do |name, dir|
+          yml = File.join(dir, "profile.yml")
+          next unless File.file?(yml)
+
+          data = begin
+            YAML.safe_load(File.read(yml)) || {}
+          rescue StandardError
+            {}
+          end
+          Array(data["panels"]).each { |panel| result[panel.to_s] << name unless result[panel.to_s].include?(name) }
+        end
+        result
+      end
+
+      # { agent_name => resolved_dir } across built-in and user agent dirs,
+      # user dir winning on name collision (matches AgentProfile lookup order).
+      private def agent_profile_dirs
+        dirs = {}
+        [Clacky::AgentProfile::DEFAULT_AGENTS_DIR, Clacky::AgentProfile::USER_AGENTS_DIR].each do |root|
+          next unless Dir.exist?(root)
+
+          Dir.children(root).each do |name|
+            next if name.start_with?("_") # _panels and other non-agent dirs
+            full = File.join(root, name)
+            next unless File.directory?(full) && File.file?(File.join(full, "profile.yml"))
+
+            dirs[name] = full
+          end
+        end
+        dirs
+      end
+
+      # Global extensions — visible for all agents (unchanged legacy behavior).
+      private def global_ext_script_tags
+        ext_script_block(WEBUI_EXT_ROOT, "/webui_ext")
+      end
+
+      # Agent-scoped UI: agents/<name>/webui/**/*.js. Each script is tagged with
+      # its owning agent so the client only mounts it for that profile.
+      private def agent_webui_script_tags
+        agent_profile_dirs.filter_map do |name, dir|
+          webui = File.join(dir, "webui")
+          next unless Dir.exist?(webui)
+
+          ext_script_block(webui, "/agent_ui/#{name}", id_prefix: "agent/#{name}/", agents: [name])
+        end.reject(&:empty?).join("\n")
+      end
+
+      # Official panels: default_agents/_panels/<id>/**/*.js. Scope comes from
+      # the panel→agents map (registerPanelAgents), so a panel only mounts for
+      # agents whose profile.yml references it.
+      private def official_panel_script_tags
+        root = File.join(Clacky::AgentProfile::DEFAULT_AGENTS_DIR, "_panels")
+        return "" unless Dir.exist?(root)
+
+        Dir.children(root).sort.filter_map do |panel|
+          dir = File.join(root, panel)
+          next unless File.directory?(dir)
+
+          ext_script_block(dir, "/panel_ui/#{panel}", id_prefix: "panel/#{panel}/", panel: panel)
+        end.reject(&:empty?).join("\n")
+      end
 
-      # GET /api/browser/status
-      # Returns real daemon liveness from BrowserManager (not just yml read).
+      # Emit begin/script/end triples for every *.js under `root`, served from
+      # `url_base`. `agents`/`panel` carry agent-scoping to _extBegin so the
+      # client can decide visibility. Returns "" when the dir is absent.
+      private def ext_script_block(root, url_base, id_prefix: "", agents: nil, panel: nil)
+        return "" unless Dir.exist?(root)
+
+        Dir.glob(File.join(root, "**", "*.js")).sort.map do |abs|
+          rel    = abs.delete_prefix(root + "/")
+          ext_id = id_prefix + rel.delete_suffix(".js")
+          src    = "#{url_base}/#{rel}"
+          # Bracket the extension's own <script> with begin/end markers so that
+          # registrations made during its synchronous evaluation are attributed
+          # to it (for crash attribution / disable). Synchronous src scripts run
+          # in document order, so the surrounding inline scripts run immediately
+          # before and after it.
+          "<script>Clacky.ext._extBegin(#{ext_id.to_json}, #{agents.to_json}, #{panel.to_json})</script>" \
+            "<script src=#{src.to_json} data-ext-id=#{ext_id.to_json}></script>" \
+            "<script>Clacky.ext._extEnd()</script>"
+        end.join("\n")
+      end
+
+      # Serve a static file from ~/.clacky/webui_ext/. Read-only, JS/CSS/HTML only,
+      # with strict path containment so a crafted path cannot escape the dir.
+      private def serve_webui_ext(req, res)
+        rel = req.path.delete_prefix("/webui_ext/")
+        abs = File.expand_path(File.join(WEBUI_EXT_ROOT, rel))
+
+        unless abs.start_with?(WEBUI_EXT_ROOT + File::SEPARATOR) && File.file?(abs)
+          res.status = 404
+          res.body   = "not found"
+          return
+        end
+
+        ext = File.extname(abs)
+        ctype = { ".js" => "application/javascript", ".css" => "text/css",
+                  ".html" => "text/html; charset=utf-8" }[ext]
+        unless ctype
+          res.status = 415
+          res.body   = "unsupported media type"
+          return
+        end
+
+        res.status           = 200
+        res["Content-Type"]  = ctype
+        res["Cache-Control"] = "no-store"
+        res["Pragma"]        = "no-cache"
+        res.body             = File.read(abs)
+      end
+
+      # Serve agents/<name>/webui/<file> from built-in or user agent dir.
+      # Path: /agent_ui/<name>/<rel>. User dir wins on name collision.
+      private def serve_agent_ui(req, res)
+        rest = req.path.delete_prefix("/agent_ui/")
+        name, _, rel = rest.partition("/")
+        dir = agent_profile_dirs[name]
+        return (res.status = 404; res.body = "not found") unless dir && !rel.empty?
+
+        serve_static_under(File.join(dir, "webui"), rel, res)
+      end
+
+      # Serve official panel assets: /panel_ui/<panel>/<rel>.
+      private def serve_panel_ui(req, res)
+        rest = req.path.delete_prefix("/panel_ui/")
+        panel, _, rel = rest.partition("/")
+        return (res.status = 404; res.body = "not found") if panel.empty? || rel.empty?
+
+        root = File.join(Clacky::AgentProfile::DEFAULT_AGENTS_DIR, "_panels", panel)
+        serve_static_under(root, rel, res)
+      end
+
+      # Read-only static serve of `rel` under `root`, JS/CSS/HTML only, with
+      # strict path containment so a crafted rel cannot escape `root`.
+      private def serve_static_under(root, rel, res)
+        root = File.expand_path(root)
+        abs  = File.expand_path(File.join(root, rel))
+        unless abs.start_with?(root + File::SEPARATOR) && File.file?(abs)
+          res.status = 404
+          res.body   = "not found"
+          return
+        end
+
+        ctype = { ".js" => "application/javascript", ".css" => "text/css",
+                  ".html" => "text/html; charset=utf-8" }[File.extname(abs)]
+        unless ctype
+          res.status = 415
+          res.body   = "unsupported media type"
+          return
+        end
+
+        res.status           = 200
+        res["Content-Type"]  = ctype
+        res["Cache-Control"] = "no-store"
+        res["Pragma"]        = "no-cache"
+        res.body             = File.read(abs)
+      end
       def api_browser_status(res)
         json_response(res, 200, @browser_manager.status)
       end
@@ -1066,7 +1333,9 @@ module Clacky
         result = Clacky::Media::Generator.new(@agent_config).generate_image(
           prompt: prompt,
           aspect_ratio: aspect_ratio,
-          output_dir: output_dir
+          output_dir: output_dir,
+          image: body["image"],
+          images: body["images"]
         )
         if result["success"]
           log_media_usage(result, prompt: prompt)
@@ -2164,6 +2433,13 @@ module Clacky
         # skills/curl talk to the server without an access key.
         return true if loopback_ip?(ip)
 
+        # Public API extension endpoints (declared via public_endpoint + meta.yml
+        # public:true) are intentionally exposed without auth — used for
+        # third-party webhooks where the extension does its own signature check.
+        if Clacky::Server::ApiExtensionDispatcher.public_path?(req.path, req.request_method)
+          return true
+        end
+
         candidate = extract_key(req)
 
         # Lazily evict expired lockout entries to prevent unbounded memory growth.
@@ -3369,7 +3645,147 @@ module Clacky
         json_response(res, 200, { skills: skill_data })
       end
 
-      # GET /api/sessions/:id/files?path=<relative dir>
+      # GET /api/sessions/:id/git/<action> — read-only git info for the session's
+      # working_dir. action ∈ status|diff|log|branches. diff accepts ?file=,
+      # log accepts ?limit=.
+      def api_session_git(session_id, action, req, res)
+        dir = git_session_dir(session_id, res)
+        return unless dir
+
+        unless Clacky::Server::GitPanel.repo?(dir)
+          return json_response(res, 200, { repo: false })
+        end
+
+        query = URI.decode_www_form(req.query_string.to_s).to_h
+        case action
+        when "status"
+          json_response(res, 200, { repo: true }.merge(Clacky::Server::GitPanel.status(dir)))
+        when "diff"
+          json_response(res, 200, { repo: true, diff: Clacky::Server::GitPanel.diff(dir, file: query["file"]) })
+        when "log"
+          json_response(res, 200, { repo: true, commits: Clacky::Server::GitPanel.log(dir, limit: query["limit"] || 50) })
+        when "branches"
+          json_response(res, 200, { repo: true, branches: Clacky::Server::GitPanel.branches(dir) })
+        else
+          json_response(res, 404, { error: "Unknown git action" })
+        end
+      end
+
+      # POST /api/sessions/:id/git/commit — body: { message:, files: [..] }.
+      def api_session_git_commit(session_id, req, res)
+        dir = git_session_dir(session_id, res)
+        return unless dir
+
+        unless Clacky::Server::GitPanel.repo?(dir)
+          return json_response(res, 400, { error: "Not a git repository" })
+        end
+
+        body = parse_json_body(req)
+        result = Clacky::Server::GitPanel.commit(dir, message: body["message"], files: body["files"])
+        if result[:ok]
+          json_response(res, 200, result)
+        else
+          json_response(res, 422, { error: result[:error] })
+        end
+      end
+
+      # GET /api/sessions/:id/time_machine — task history for the Time Machine
+      # panel. Mirrors the CLI menu: each entry carries id, summary, status
+      # (current/past/undone) and whether it branches.
+      def api_session_time_machine(session_id, res)
+        agent = time_machine_agent(session_id, res)
+        return unless agent
+
+        history = agent.get_task_history(limit: 20)
+        json_response(res, 200, { tasks: history })
+      end
+
+      # POST /api/sessions/:id/time_machine/switch — body: { task_id: }.
+      # Restores the working tree to the end-of-task state of task_id.
+      def api_session_time_machine_switch(session_id, req, res)
+        agent = time_machine_agent(session_id, res)
+        return unless agent
+
+        body = parse_json_body(req)
+        task_id = body["task_id"].to_i
+        result = agent.switch_to_task(task_id)
+        if result[:success]
+          @session_manager.save(agent.to_session_data(status: :success))
+          broadcast_session_update(session_id)
+          json_response(res, 200, { ok: true, message: result[:message], task_id: result[:task_id] })
+        else
+          json_response(res, 422, { ok: false, error: result[:message] })
+        end
+      end
+
+      # GET /api/sessions/:id/time_machine/:task_id/diff
+      # Without ?path: returns the file list this task touched.
+      # With ?path=<rel>: returns the unified diff of that file.
+      def api_session_time_machine_diff(session_id, task_id, req, res)
+        agent = time_machine_agent(session_id, res)
+        return unless agent
+
+        rel = req.query["path"].to_s
+        if rel.empty?
+          json_response(res, 200, { ok: true, task_id: task_id, files: agent.task_diff_files(task_id) })
+        else
+          diff = agent.task_file_diff(task_id, rel)
+          if diff.nil?
+            json_response(res, 404, { ok: false, error: "No diff for #{rel}" })
+          else
+            json_response(res, 200, { ok: true, task_id: task_id }.merge(diff))
+          end
+        end
+      end
+
+      # GET /api/sessions/:id/time_machine/:task_id/restore_preview
+      # Returns the file-level effect of switching back to this task without
+      # actually performing the switch. Lets the UI render an honest
+      # confirmation listing the files that would be overwritten/created/deleted.
+      def api_session_time_machine_restore_preview(session_id, task_id, res)
+        agent = time_machine_agent(session_id, res)
+        return unless agent
+
+        changes = agent.preview_restore_to_task(task_id)
+        json_response(res, 200, { ok: true, task_id: task_id, changes: changes })
+      end
+
+      # Resolve a session's agent for time-machine ops; writes the error
+      # response and returns nil on failure.
+      private def time_machine_agent(session_id, res)
+        unless @registry.ensure(session_id)
+          json_response(res, 404, { error: "Session not found" })
+          return nil
+        end
+        session = @registry.get(session_id)
+        agent   = session && session[:agent]
+        unless agent
+          json_response(res, 404, { error: "Session not found" })
+          return nil
+        end
+        agent
+      end
+
+      # Resolve a session's working_dir for git ops; writes the error response
+      # and returns nil on any failure.
+      private def git_session_dir(session_id, res)
+        unless @registry.ensure(session_id)
+          json_response(res, 404, { error: "Session not found" })
+          return nil
+        end
+        session = @registry.get(session_id)
+        agent   = session && session[:agent]
+        unless agent
+          json_response(res, 404, { error: "Session not found" })
+          return nil
+        end
+        dir = File.expand_path(agent.working_dir.to_s)
+        unless Dir.exist?(dir)
+          json_response(res, 404, { error: "Working directory not found" })
+          return nil
+        end
+        dir
+      end
       # Lists one directory level inside the session's working_dir (lazy, per-layer).
       # Path traversal outside working_dir is rejected. Noisy dirs are hidden.
       IGNORED_FILE_ENTRIES = %w[.git .svn .hg node_modules .DS_Store .bundle vendor/bundle tmp .sass-cache].freeze
@@ -3430,7 +3846,7 @@ module Clacky
         # Directories first, then files; both case-insensitive alphabetical.
         items.sort_by! { |it| [it[:type] == "dir" ? 0 : 1, it[:name].downcase] }
 
-        json_response(res, 200, { root: display_root, path: rel, entries: items })
+        json_response(res, 200, { root: display_root, path: rel, home: Dir.home, default: default_working_dir, entries: items })
       rescue StandardError => e
         json_response(res, 500, { error: e.message })
       end
@@ -3468,11 +3884,56 @@ module Clacky
         end
         items.sort_by! { |it| it[:name].downcase }
 
-        json_response(res, 200, { root: target, path: target, parent: File.dirname(target), home: Dir.home, entries: items })
+        json_response(res, 200, { root: target, path: target, parent: File.dirname(target), home: Dir.home, default: default_working_dir, entries: items })
+      rescue StandardError => e
+        json_response(res, 500, { error: e.message })
+      end
+
+      # ── Directory mutation API used by the path picker ─────────────────
+      # Validate a folder name supplied by the picker UI:
+      # non-empty, no path separators, not "."/"..", short-ish.
+      private def picker_valid_name?(name)
+        return false if name.nil?
+        return false if name.empty? || name.length > 255
+        return false if name == "." || name == ".."
+        # Reject path separators (forward slash and backslash).
+        return false if name.match?(%r{[/\\]})
+        true
+      end
+
+      # POST /api/dirs/mkdir
+      # Body: { parent: "/abs/parent", name: "New Folder" }
+      def api_dirs_mkdir(req, res)
+        body   = parse_json_body(req)
+        parent = body["parent"].to_s
+        name   = body["name"].to_s.strip
+
+        return json_response(res, 422, { error: "parent must be an absolute path" }) unless parent.start_with?("/")
+        return json_response(res, 422, { error: "name is invalid" }) unless picker_valid_name?(name)
+
+        parent = File.expand_path(parent)
+        return json_response(res, 404, { error: "Parent directory not found" }) unless Dir.exist?(parent)
+
+        target = File.join(parent, name)
+        return json_response(res, 422, { error: "Already exists" }) if File.exist?(target)
+
+        FileUtils.mkdir_p(target)
+        json_response(res, 200, { ok: true, path: target, name: name })
       rescue StandardError => e
         json_response(res, 500, { error: e.message })
       end
 
+      # NOTE: there is NO PATCH /api/dirs/rename endpoint.
+      # Directory rename was intentionally removed from the picker —
+      # too dangerous for a one-click UI affordance (renaming an in-use
+      # workspace mid-session can break tasks, sessions, MCP configs, …).
+      # Use the terminal for that.
+
+      # NOTE: there is NO DELETE /api/dirs/delete endpoint.
+      # Directory deletion was intentionally removed from the picker —
+      # too dangerous for a one-click UI affordance, even with a trash
+      # bucket fallback. Use the terminal (safe_rm) for that.
+
       # Body: { enabled: true/false }
       def api_toggle_skill(name, req, res)
         body    = parse_json_body(req)
@@ -3489,6 +3950,47 @@ module Clacky
         json_response(res, 422, { error: e.message })
       end
 
+      private def api_skill_content_get(name, res)
+        @skill_loader.load_all
+        skill = @skill_loader[name]
+        return json_response(res, 404, { ok: false, error: "Skill not found: #{name}" }) unless skill
+
+        skill_md = File.join(skill.directory.to_s, "SKILL.md")
+        unless File.exist?(skill_md)
+          return json_response(res, 404, { ok: false, error: "SKILL.md not found" })
+        end
+
+        json_response(res, 200, {
+          ok:      true,
+          name:    skill.identifier,
+          content: File.read(skill_md),
+          path:    skill_md
+        })
+      end
+
+      private def api_skill_content_update(name, req, res)
+        @skill_loader.load_all
+        skill = @skill_loader[name]
+        return json_response(res, 404, { ok: false, error: "Skill not found: #{name}" }) unless skill
+
+        if skill.source_path.nil? || @skill_loader.loaded_from[skill.identifier] == :default
+          return json_response(res, 403, { ok: false, error: "System skills cannot be edited" })
+        end
+
+        data    = parse_json_body(req)
+        content = data["content"].to_s
+        skill_md = File.join(skill.directory.to_s, "SKILL.md")
+        unless File.exist?(skill_md)
+          return json_response(res, 404, { ok: false, error: "SKILL.md not found" })
+        end
+
+        File.write(skill_md, content)
+        @skill_loader.load_all
+        json_response(res, 200, { ok: true, name: skill.identifier })
+      rescue StandardError => e
+        json_response(res, 500, { ok: false, error: e.message })
+      end
+
       private def api_delete_skill(name, res)
         skill = @skill_loader[name]
         return json_response(res, 404, { error: "Skill not found: #{name}" }) unless skill
@@ -4347,7 +4849,6 @@ module Clacky
         json_response(res, 422, { error: e.message })
       end
 
-      # POST /api/config — save updated model list
       # DEPRECATED: this endpoint previously accepted the entire models array
       # and replaced @models in place. That design was fragile — any missing
       # or stale field on ANY row could wipe other rows' api_keys. It has
@@ -4372,8 +4873,15 @@ module Clacky
         model    = body["model"].to_s.strip
         base_url = body["base_url"].to_s.strip
         api_key  = body["api_key"].to_s
-        # Masked placeholders are never a valid api_key on creation —
-        # a brand-new model MUST come with a real key.
+        # When duplicating, the frontend sends source_id so we can inherit the
+        # real key without ever transmitting it back to the client.
+        if api_key.empty? || api_key.include?("****")
+          source_id = body["source_id"].to_s
+          unless source_id.empty?
+            source  = @agent_config.models.find { |m| m["id"] == source_id }
+            api_key = source["api_key"].to_s if source
+          end
+        end
         if api_key.empty? || api_key.include?("****")
           return json_response(res, 422, { error: "api_key is required" })
         end
@@ -5085,8 +5593,13 @@ module Clacky
             conn.send_json(type: "error", message: "Session not found: #{session_id}")
           end
 
+        when "edit_message"
+          session_id = msg["session_id"] || conn.session_id
+          handle_edit_message(session_id, msg["content"].to_s, msg["created_at"].to_s)
+
         when "message"
           session_id = msg["session_id"] || conn.session_id
+          Thread.current[:lang] = msg["lang"].to_s.strip.then { |l| l.empty? ? nil : l }
           # Merge legacy images array into files as { data_url:, name:, mime_type: } entries
           raw_images = (msg["images"] || []).map do |data_url|
             { "data_url" => data_url, "name" => "image.jpg", "mime_type" => "image/jpeg" }
@@ -5135,6 +5648,20 @@ module Clacky
 
       # ── Session actions ───────────────────────────────────────────────────────
 
+      def handle_edit_message(session_id, content, created_at)
+        return unless @registry.exist?(session_id)
+
+        agent = nil
+        @registry.with_session(session_id) { |s| agent = s[:agent] }
+        return unless agent
+
+        if agent.history.respond_to?(:truncate_from_created_at) && !created_at.to_s.empty?
+          agent.history.truncate_from_created_at(created_at)
+        end
+
+        handle_user_message(session_id, content)
+      end
+
       def handle_user_message(session_id, content, files = [])
         return unless @registry.exist?(session_id)
 
@@ -5169,13 +5696,15 @@ module Clacky
         end
 
         # Broadcast user message through web_ui so channel subscribers (飞书/企微) receive it.
+        # created_at is shared with agent.run so the history entry and the bubble use the same value.
+        msg_created_at = Time.now.to_f
         web_ui = nil
         @registry.with_session(session_id) { |s| web_ui = s[:ui] }
-        web_ui&.show_user_message(content, source: :web)
+        web_ui&.show_user_message(content, created_at: msg_created_at, source: :web)
 
         # File references are now handled inside agent.run — injected as a system_injected
         # message after the user message, so replay_history skips them automatically.
-        run_agent_task(session_id, agent) { agent.run(content, files: files) }
+        run_agent_task(session_id, agent) { agent.run(content, files: files, created_at: msg_created_at) }
       end
 
       def deliver_confirmation(session_id, conf_id, result)
@@ -5362,7 +5891,9 @@ module Clacky
 
         broadcast_session_update(session_id)
 
+        locale = Thread.current[:lang]
         thread = Thread.new do
+          Thread.current[:lang] = locale
           task.call
           @registry.update(session_id, status: :idle, error: nil)
           broadcast_session_update(session_id)
@@ -5389,10 +5920,11 @@ module Clacky
             preset = Clacky::Providers::PRESETS[e.provider_id]
             top_up_url = preset && preset["website_url"]
           end
-          @registry.update(session_id, status: :error, error: e.message, error_code: code, top_up_url: top_up_url)
+          user_message = e.respond_to?(:display_message) && e.display_message ? e.display_message : e.message
+          @registry.update(session_id, status: :error, error: user_message, error_code: code, top_up_url: top_up_url)
           broadcast_session_update(session_id)
-          web_ui&.show_error(e.message, code: code, top_up_url: top_up_url)
-          @session_manager.save(agent.to_session_data(status: :error, error_message: e.message))
+          web_ui&.show_error(user_message, code: code, top_up_url: top_up_url)
+          @session_manager.save(agent.to_session_data(status: :error, error_message: user_message))
         end
         @registry.with_session(session_id) { |s| s[:thread] = thread }
       end